List quick-check scan tasks.

Returns totalCount and quickVOS (each carries taskVO.pkTask / taskName / taskStatus / language, plus owner and time). Use a pkTask as taskId below.

Get a task's metadata and code statistics (file/line counts, template, times).

Aggregate defects by rule (from bugType). Use this to pick a rule to audit.

Returns per-rule: ruleCode, ruleName, category, severity level, and total. IDs are omitted by default; set include_ids=true to include a bounded sample.

Page through defect instances.

NOTE: the server endpoint ignores level/ruleCode filtering, so when those are supplied the filter is applied client-side to this single page only (returned count may be < page_size). For a complete filtered set, use codesafe_bug_summary + codesafe_audit_by_rule.

Summarize a report's audit progress from the platform auditState field.

Get full defect detail: rule definition (desc/solution/CWE), the taint dataflow trace (bugTraces), exact location, and existing audit state.

Fetch a range of source lines (1-based, inclusive) for the file behind a bug.

The platform ignores the line range and returns the whole file, so we slice the requested [begin_line, end_line] window client-side with line numbers.

Assemble a judgment-ready audit context for one defect.

Pulls the rule definition + taint dataflow trace + sink code context in one call, reconstructs the source→sink path, and returns it together with the judging criteria and output schema. The verdict itself is produced by the calling LLM (design §8 option A) — nothing is written to the platform.

Respond with a judgment following instructions.output_schema, grounded in context_text.

Batch-assemble audit contexts for up to max_n defects of one rule.

Resolves the rule's bugIds via codesafe_bug_summary, then builds an audit_bug context for each (capped at max_n and CODESAFE_AUDIT_BATCH_LIMIT). Returns contexts + a summary table skeleton the calling LLM can fill with verdicts. Read-only.

Write audit verdicts back to the platform (POST /codesafeapi/result/audit), so the Web UI shows 误报/确认 markers and PDF exports include them.

audits: list of {bugId OR pkResbug, auditResult OR verdict, auditMemo?}.

• bugId: the 32-char hash (from codesafe_list_bugs). A numeric pkResbug may be passed as bugId — it is auto-routed to the pkResbug field.

• pkResbug: the numeric defect id (alternative to bugId).

• auditResult: platform code directly (5=是问题, 6=不是问题/误报, 9=遗留).

• verdict: real/false_positive/needs_review (mapped to 5/6/9). dry_run (default true): preview the payload without writing. To commit, CODESAFE_ENABLE_WRITE must be true and confirm_write must be explicitly true.

⚠️ This is the only tool that mutates the platform. Prefer dry_run first, and write in small batches. Each write is verified — if the bug's auditState does not actually change (e.g. ID not resolved), the tool raises instead of silently leaving only a comment.